npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 613
Updated 25 Oct 2026, 06:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6376 blocks this version. Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js (README, source, version banner v7.0.1, and r...
OpenSSF/OSV malware advisory MAL-2026-3359 blocks this version. The package b2bneo-rest was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4543 blocks this version. On npm install, postinstall.js collects git identity, OS user/uid, hostname, internal network interface addresses, Cloudfla...
OpenSSF/OSV malware advisory MAL-2026-4543 blocks this version. On npm install, postinstall.js collects git identity, OS user/uid, hostname, internal network interface addresses, Cloudfla...
OpenSSF/OSV malware advisory MAL-2026-4543 blocks this version. On npm install, postinstall.js collects git identity, OS user/uid, hostname, internal network interface addresses, Cloudfla...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6152 blocks this version. The npm package `custom-save-area-block` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Na...
OpenSSF/OSV malware advisory MAL-2026-6294 blocks this version. The package's postinstall.js script runs automatically on `npm install` and collects host identifying data (os.hostname())...
OpenSSF/OSV malware advisory MAL-2026-3836 blocks this version. package.json declares a postinstall script that runs `node src/install.js` after building a local binary. `src/install.js`...
OpenSSF/OSV malware advisory MAL-2026-6545 blocks this version. Package name impersonates the Crossmint wallet SDK family. Both preinstall.js and index.js import child_process, capture ho...
OpenSSF/OSV malware advisory MAL-2024-2031 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script colle...
OpenSSF/OSV malware advisory MAL-2024-2031 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script colle...
OpenSSF/OSV malware advisory MAL-2024-2031 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script colle...
OpenSSF/OSV malware advisory MAL-2026-3502 blocks this version. The package cross-stitch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3502 blocks this version. The package cross-stitch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3502 blocks this version. The package cross-stitch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3502 blocks this version. The package cross-stitch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3502 blocks this version. The package cross-stitch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4235 blocks this version. credential-verification-cli@1.0.0 is a thin wrapper whose only behavior is to download and execute whatever code is current...
OpenSSF/OSV malware advisory MAL-2026-5894 blocks this version. OSV/OpenSSF confirms create-vercel-integration@1.0.0 as malicious package MAL-2026-5894. Malicious code in create-vercel-in...